feat(auth): sessions end when they should; logins are throttled; Secure behind HTTPS (#5035)

#5035 "Sessions: lifetime applied, role and is_active re-read per request,
logout is a POST, failed logins throttled".

- steward/core/proxy.py: trusted_value / is_https / client_ip read
  X-Forwarded-Proto and -For only as far as the trusted proxy hops
  (Settings → General, default 1, 0 = trust none).
- The session cookie is Secure, and HSTS is sent, only on requests that
  arrived over HTTPS by that rule; plain-HTTP and LAN use are unchanged
  and nothing redirects.
- A login lasts Settings → General's session lifetime from when it began
  (session.permanent + a login_at stamp checked every request — the
  cookie's own age slides on every response). A deleted or deactivated
  user is logged out on their next request; a role change applies at once.
- Logout is a POST (a form in the sidebar); GET /logout is gone.
- Failed logins pause an address after login.max_failures within
  login.lockout_minutes (Settings → General; defaults 5 in 15 min),
  keyed by address so nobody can lock a user out by name. Failures are
  audited as auth.login_failed with the address.
- to_access_cfg projects the new settings into app.config at startup and
  on save, beside the existing projections.
- Integration tests seed real users and a login_at, since every request
  now re-reads the session's user.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/general.html

@@ -21,10 +21,35 @@
     </div>
   </div>
 
+  <div class="form-group">
+    <label>Trusted reverse proxies</label>
+    <input type="number" name="general.trusted_proxy_hops" min="0" max="5"
+           value="{{ settings['general.trusted_proxy_hops'] }}" style="max-width:120px;">
+    <div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">
+      How many proxies sit in front of Steward (e.g. 1 for Traefik, 2 for Cloudflare in front of Traefik).
+      Steward believes their X-Forwarded-For and X-Forwarded-Proto headers up to that many hops: it marks
+      the login cookie Secure and sends HSTS only when they report HTTPS, and throttles logins by the address
+      they report. 0 trusts no proxy.
+    </div>
+  </div>
+
   <div class="form-group">
     <label>Session lifetime <span style="color:var(--text-muted);font-size:0.8rem;">(hours)</span></label>
     <input type="number" name="session.lifetime_hours" min="1" max="720"
            value="{{ settings['session.lifetime_hours'] }}" style="max-width:120px;">
+    <div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">A login lasts this long; then Steward asks for the password again.</div>
+  </div>
+
+  <div class="form-group">
+    <label>Failed logins before a pause</label>
+    <div style="display:flex;gap:0.5rem;align-items:center;flex-wrap:wrap;">
+      <input type="number" name="login.max_failures" min="1" max="100"
+             value="{{ settings['login.max_failures'] }}" style="max-width:90px;">
+      <span style="font-size:0.85rem;color:var(--text-muted);">failures from one address pause its logins for</span>
+      <input type="number" name="login.lockout_minutes" min="1" max="1440"
+             value="{{ settings['login.lockout_minutes'] }}" style="max-width:90px;">
+      <span style="font-size:0.85rem;color:var(--text-muted);">minutes</span>
+    </div>
   </div>
 
   <div class="form-group">